Privacy policy

Last updated 18 October 2026

Prepwise is a practice service for children, run by Total IT Experience Ltd ("we", "us"). This policy explains what personal information we collect, why, and the choices you have. We have written it to be read by parents, guardians and academies.

Company: Total IT Experience Ltd, company number [company number], registered office [registered office address]. ICO registration: [ICO registration number]. Contact: aijazazeesh@gmail.com.

1. Who is responsible for the information

• Families. When a parent creates an account and adds their children, we are the "controller" of that information.
• Academies. When an academy adds its learners, the academy is the controller and we act as its "processor", handling the information on the academy's instructions under our agreement with it. Questions about an academy learner's information should go to the academy first.

2. What we collect

• Parents: first name and email address.
• Children and learners: first name, year group, course and subjects, optional exam date, and their practice results (answers, scores, XP, streaks, mock paper results and topics they find hard). A parent-created child login uses an email address and PIN. An academy learner login uses a username and PIN. PINs and passwords are stored in a protected, hashed form by our sign-in provider.
• Academy guardians: if an academy chooses to send progress emails, the academy gives us a guardian's name and email address.
• Academy staff: user ID, display name, role and sign-in activity.
• Enquiries: the name, email, academy name and message you send us through the website.
• Technical data: basic logs (such as IP address and browser type) kept by our hosting and security providers to keep the service running and secure.

We do not ask children for photographs, location, or free-text personal details, and the service has no chat or social features with strangers.

3. How we use it, and our legal basis

• To provide the service: accounts, practice, mock papers, worksheets, progress views, and emails you ask for (contract, and legitimate interests in running the service).
• To choose suitable questions for each child. This is an automated process that adjusts difficulty from past answers. It has no legal or similarly significant effect on anyone.
• To keep the service safe and fix problems (legitimate interests).
• To send weekly progress emails to guardians on behalf of an academy (the academy's lawful basis, which it must explain to guardians). Every email has a link to stop them.
• To answer enquiries (legitimate interests).

We do not sell personal information, we do not show advertising, and we do not use children's information for marketing.

4. Children

Children's accounts are created by a parent or by an academy, not by the child. We collect the minimum needed and design the service with the ICO's Age Appropriate Design Code in mind. Parents control whether games and the family league are switched on, and can delete a child's information at any time from their dashboard. In academies, the academy's staff control these settings.

5. Who we share it with

We use trusted service providers to run Prepwise. They only process information on our instructions:

• Supabase: database, sign-in and file storage.
• Vercel: website hosting.
• An email delivery provider: sign-in emails and progress emails.

Some of these providers may process information outside the UK. Where they do, we rely on approved safeguards such as the UK International Data Transfer Agreement or Addendum. We may also share information if the law requires it. Within an academy, only that academy's authorised staff can see its learners' information, and parents can only see their own children.

6. How long we keep it

We keep information while an account is active. Deleting a child (or an academy deleting a learner) removes their login and results straight away. If you want your whole account deleted, email us and we will do so within 30 days. Copies in backups are removed on the normal backup cycle. Enquiries are kept for up to 24 months.

7. Security

We use encrypted connections, access controls that separate each family and academy from the others, hashed passwords and PINs, restricted administrator access with optional two-step sign-in, and activity logs for sensitive actions. No system is perfectly secure, so please keep PINs and passwords private and tell us at once if you think an account has been misused.

8. Cookies and similar technologies

We use only essential cookies that keep you signed in, and small items of local storage that remember your preferences (for example easy-read mode and whether you dismissed the install banner). We do not use advertising or tracking cookies. Because these are essential, no cookie banner is needed.

9. Your rights

Under UK data protection law you can ask to see your information, correct it, delete it, restrict or object to how we use it, and receive a copy in a portable format. To use these rights email aijazazeesh@gmail.com. For an academy learner, please contact the academy, which we will help. If you are unhappy, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

10. Changes

If we change this policy in a way that matters, we will update the date above and tell account holders where we reasonably can.